[websec] Issue 55 - Key pinning should clarify that the newest pinning information takes precedence

["Ryan Sleevi" <[e-mail]>]

This was raised with http://trac.tools.ietf.org/wg/websec/trac/ticket/55 ,
as a concern about the interaction between static/preloaded pin entries
and those that were noted later (eg: through the observation of the
header)

In draft-04, Section 2.7
http://tools.ietf.org/html/draft-ietf-websec-key-pinning-04#section-2.7
addresses this by indicating that UAs MUST use the newest information
available.

Note: This does not normatively describe how a UA must determine newest.
The assumption here is that this represents the "newest observed", but the
question is whether or not that should be explicitly specified.

For example, imagine a UA that supports automatic updates to Preloaded Pin
Lists. One interpretation of "newest information" would be to look at the
most recent update to the preloaded pin list as a whole. Another
interpretation of "newest information" may be to look at the date/time
that the entry was originally added/updated in the "preloaded pin list".

Imagine this UA had a preload for Site 1 to a set of pins, with the
preload created at T=0. Later, at T=5, it observes a Max-Age of 0,
effectively unpinning the host. At T=10, the UA vendor ships a new update
to the preloaded pin list that adds Site 2, but which has not been updated
to unpin Site 1.

Under the first interpretation of "newest information", Site 1 would be
"reactivated", by virtue of observing an update to the preloaded pin list.
Under the second interpretation, Site 1 would remain unpinned.

The authors belief is that the issues that arise from either
implementations are artifacts of the implementation and distribution of
preloaded pins, rather than an issue intrinsic to this specification. That
is, the "correct" answer is that the preloaded pin list should be updated
for Site 1 - however that information is distributed between the site
operator and the creator of the preloaded pin list.

Are there concerns with this interpretation, or can we close out Issue 55?